Providers / Apple Developer Program
App stores
Apple Developer Program API keys and credentials
What every Apple Developer Program credential a founder holds does, whether it expires, and what tends to break. Each fact links to Apple Developer Program's own docs.
At a glance
| Credential | Expiry | Permissions |
|---|---|---|
| Apple Development certificate | Expires after 1 year | Full access only |
| Apple Distribution certificate (App Store / TestFlight signing) | Fixed lifetime | Full access only |
| APNs push certificate (.p12) | Fixed lifetime | Can be scoped |
| APNs auth key (.p8) | Not documented | Can be scoped |
| App Store Connect API key (Team key) | Not documented | Can be scoped |
| App Store Connect API key (Individual key) | Not documented | Can be scoped |
| Apple Account / Apple Developer login | Not documented | – |
Each credential
Apple Development certificate
- Expires after 1 year
- Full access only
Apple's (archived, retired 2013) guide states development certificates are valid for one year from date of issue; after expiry, apps signed with it no longer run on a device. Apple can revoke earlier. Current help page does not restate the period.
Apple Distribution certificate (App Store / TestFlight signing)
- Fixed lifetime
- Full access only
Expiry consequences per Apple: after expiry you cannot upload new apps or updates signed with it to App Store Connect; existing App Store apps are not affected while membership is valid. In-house distribution: users cannot run apps signed with an expired certificate; a new build signed with a new certificate must be distributed. Apple can revoke certificates at any time; a revoked certificate blocks uploads and installs. Apple's certificate overview and expiration pages state no validity period for distribution certificates; community sources say one year, which is not official.
APNs push certificate (.p12)
- Fixed lifetime
- Can be scoped
Apple: once it expires you can no longer send push notifications to the app. An APNs auth key (.p8) is the documented alternative. Validity period not confirmed on the fetched pages.
APNs auth key (.p8)
- Not documented
- Can be scoped
Token-based alternative to APNs certificates, generated for server-side notification requests. Can be Team Scoped or Topic Specific (topics are selected per key). The .p8 file can be downloaded only once; store it securely. The fetched Apple page did not state expiry or revocation behaviour for APNs keys. Apple's key pages (create, revoke/edit/download) do not mention expiry; revoking a key makes it invalid for services using it.
App Store Connect API key (Team key)
- Not documented
- Can be scoped
Created in App Store Connect by an Account Holder or Admin, with a role that limits what the API can do. Team keys apply across all apps; app access cannot be limited for a key. Name and access level cannot be edited after creation; to change them, revoke and recreate. The private key can be downloaded only once; revoke immediately if lost or compromised. Revoked keys cannot be reinstated and appear under Revoked for 30 days. The fetched page does not state whether keys expire. Team keys are not available for the Enterprise Program API.
App Store Connect API key (Individual key)
- Not documented
- Can be scoped
Tied to the creating user and inherits that user's role. Each user can have one active individual key at a time. Admins can remove the Generate Individual API Keys permission from a user. Same one-time download and revocation rules as team keys.
Apple Account / Apple Developer login
- Not documented
Membership renewal must be done by the Account Holder, who also controls auto-renew. Account Holder role changes must be made after a renewal completes.
What usually goes wrong
- Annual membership lapses and apps disappear from the App Store; submissions and certificate access stop until renewed
- Distribution certificate expires and the next build cannot be uploaded or signed
- APNs certificate expires and push notifications silently stop
- Lost or compromised App Store Connect .p8 key must be revoked and replaced; the file cannot be downloaded again
- APNs .p8 key downloaded once only; a lost file requires a new key
- Certificate revoked by Apple or the team blocks uploads and installs immediately
Renewals and billing
- Apple Developer Program membership, billed yearly. Annual. Manual renewal can start 30 days before expiry. Auto-renew is optional and charges the default card on the expiration date (certain regions only). On lapse: apps are no longer downloadable, you cannot submit new apps or updates or access Certificates, Identifiers & Profiles; already-installed apps keep running. Free apps return within 24 hours of renewal; paid apps need the Paid Applications Agreement re-accepted. Test devices are removed 180 days after expiry unless removed sooner by opt-in. Enterprise Program software keeps running 90 days after expiry for existing users while certificates and profiles remain valid. Apple's page describes no grace period and does not state the fee. If enrolled via the Developer app, membership is an auto-renewable subscription that can be resubscribed up to one year after expiry.
Annual membership. No spend or usage API was verified for membership billing.
What Apple Developer Program's docs don't say
We couldn't confirm these from official docs, so don't rely on them either way:
- Validity period for Apple Distribution and APNs certificates (not stated on current official Apple pages; community sources say one year)
- Whether App Store Connect API keys expire (the official help page does not say; general knowledge says no expiry, with JWTs limited to 20 minutes, but not confirmed on a fetched page)
- Whether certificate expiry is readable via the App Store Connect API
- Maximum number of active App Store Connect team keys (not stated)
- Current annual membership fee and any grace period after lapse (renewal page describes none)
Rotating or replacing a Apple Developer Program key
The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:
Sources
- developer.apple.com/help/account/membership/renewal
- developer.apple.com/help/account/certificates/certificates-overview
- developer.apple.com/help/account/manage-keys/create-a-private-key/
- developer.apple.com/help/app-store-connect/get-started/app-store-connect-api
- developer.apple.com/library/archive/documentation/ToolsLanguages/Conceptual/DevPortalGuide/ManagingiOSDevelopmentCertificates/ManagingiOSDevelopmentCertificates.html
- developer.apple.com/support/expiration/
- developer.apple.com/help/account/keys/revoke-edit-and-download-keys
- developer.apple.com/programs/enroll/
Related providers
Keep track of every Apple Developer Program key
StackHangar stores your Apple Developer Program keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.